User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:13.0a1) Gecko/20120214 Firefox/13.0a1 Build ID: 20120214031227 Steps to reproduce: I made an SVG file with an image tag referencing a none-existing image, and a use tag referencing the image tag. Please see the attached SVG file. Actual results: Firefox tries to fetch the failing image over and over again (as fast as it can?). CPU load becomes very high. Expected results: It should fail and then not try to refetch the broken image.

Regression window(cached m-c) Works: http://hg.mozilla.org/mozilla-central/rev/2cf6a6d0f962 Mozilla/5.0 (Windows; Windows NT 6.1; WOW64; en-US; rv:2.0b2pre) Gecko/20100715 Minefield/4.0b2pre ID:20100715124457 Fails: http://hg.mozilla.org/mozilla-central/rev/b5e3a1cc45f0 Mozilla/5.0 (Windows; Windows NT 6.1; WOW64; en-US; rv:2.0b2pre) Gecko/20100715 Minefield/4.0b2pre ID:20100715132203 Pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=2cf6a6d0f962&tochange=b5e3a1cc45f0 In local build: Last good : 2cf6a6d0f962 First bad : d5bc811bad0a Triggered by: d5bc811bad0a Timothy Nikkel — Bug 558663. When recreating frames, recreate the parent if the parent is a leaf frame. r=bzbarsky

So the problem is that imagelib tells us async that the image is broken, we go to reframe it, its parent is a leaf, so we reframe the parent. In the case of <use> does that recreate the anonymous content or something? Fundamentally, the issue is bug 648568, of course, but if SVG recreates anon content on <use> reframe that feels buggy to me...

(In reply to Boris Zbarsky (:bz) from comment #2) > So the problem is that imagelib tells us async that the image is broken, we > go to reframe it, its parent is a leaf, so we reframe the parent. In the > case of <use> does that recreate the anonymous content or something? > Yes, it does seem to recreate the anonymous content which rebinds the image and we start all over again.

OK. Why does it need to do that? Can we avoid that?

The image reframe causes the anonymost content to be recreated and the use clones that in nsSVGUseFrame::CreateAnonymousContent I'm not sure how to break the cycle.

> The image reframe causes the anonymost content to be recreated Which anonymous content? > and the use clones that in nsSVGUseFrame::CreateAnonymousContent Can we create (and cache!) the anonymous content in the <use> _element_ instead of the <use> frame?

The frame is a nsIAnonymousContentCreator which is why it's notified about the anonymous content creation. nsIAnonymousContentCreator is a layout thing.

nsIAnonymousContentCreator::CreateAnonymousContent doesn't have to create brand-new elements. It can return elements that are cached on the content node and were created on a previous call. This is what input elements and textareas do with the editable node, for example. And for <use> the frame already calls through to the content node, which already knows when it has an mClone. All we'd need to do is to only null out mClone when we really actually need to, instead of any time we get reframed.